Privacy Policy

Please note: the legally binding version of this Privacy Policy is the Hungarian text. This English translation is provided for convenience; in case of any discrepancy, the Hungarian version prevails.

1. Name of the data controller

Name of the data controller: — Tálos Martin, sole trader

Registration number of the data controller: — 55656285

Registered seat of the data controller: — 8706 Nikla, Berzsenyi Dániel utca 108/A

Representative of the data controller: — Tálos Martin, sole trader

1. Rules of data processing

This Privacy Policy is effective from 1 May 2018 until revocation.

The conceptual framework of this policy corresponds to the interpretive definitions set out in Article 4 of the General Data Protection Regulation (hereinafter: GDPR), supplemented in certain points by the interpretive provisions of Section 3 of the Hungarian Information Act (Infotv.) in force from 25 May 2018. Accordingly:

personal data: any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, a number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

consent: any freely given, specific, informed and unambiguous indication of the data subject's wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them;

controller: the natural or legal person, public authority, agency or any other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;

processing: any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

processor: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;

personal data breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;

Personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject.

The data controller makes this policy continuously available on its website. Acceptance of the Privacy Policy (ticking the relevant checkbox) confirms that it has been read and constitutes consent to data processing. Processing may therefore take place only if the data subject gives free, specific, informed and unambiguous consent to the processing of personal data relating to a natural person, by a clear affirmative action such as a written — including electronic — statement.

Personal data collected by the controller may only be processed for specified, explicit and legitimate purposes, and may not be processed in a manner incompatible with those purposes; storage must be in a form which permits identification of data subjects for no longer than is necessary to achieve the purposes of the processing.

Employees performing data processing at the controller, and the employees of organisations involved in the processing on the controller's behalf, are obliged to keep the personal data they learn as a business secret. The controller's staff ensure that unauthorised persons cannot access personal data. They also ensure that personal data is stored and placed so that it is not accessible, knowable, alterable or destroyable by unauthorised persons.

If a person subject to this policy becomes aware that personal data processed by the controller is incorrect, incomplete or out of date, they must correct it or initiate its correction with the staff member responsible for recording the data.

1. Exercising the rights of data subjects

The data subject may request information about the processing of their personal data; may request the correction of their personal data; the erasure of their data at the e-mail address info@zoldsegesem.hu; the restriction of processing; and is entitled to data portability.

3.1. Right to information

The data subject has the right to obtain confirmation from the controller as to whether their personal data is being processed, and if so, the right to access the personal data and the following information:

• the right to know the purpose of the processing;
• the categories of personal data concerned;
• the recipients or categories of recipients to whom the personal data has been or will be disclosed, in particular recipients in third countries or international organisations;
• where possible, the envisaged storage period of the personal data, or, if not possible, the criteria used to determine that period;
• the right to be informed of the right to request from the controller the rectification, erasure or restriction of processing of the personal data concerning them, and to object to such processing; and to lodge a complaint with a supervisory authority;
• the right to receive all available information about the source of the data where it was not collected from the data subject;
• the right to be informed about the logic involved in automated decision-making, as well as the significance and the envisaged consequences of such processing for the data subject.

The controller informs the data subject of the measures taken in response to an information request without undue delay, but in any case within one month of receipt of the request. If necessary, taking into account the complexity and number of the requests, this period may be extended by a further two months. The controller informs the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay.

As a general rule, information is provided free of charge; the controller charges a fee only in the cases set out in Article 12 (5) and Article 15 (3) of the GDPR.

If the controller does not take action on the data subject's request, it informs the data subject without delay, and at the latest within one month of receipt of the request, of the reasons for not taking action and of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.

The data subject has the right to obtain from the controller, without undue delay, the rectification of inaccurate personal data concerning them. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of a supplementary statement (right to rectification).

3.2. Right to rectification

The Company rectifies data that does not correspond to reality without undue delay at the data subject's request.

For the period during which the Company verifies the accuracy of the personal data, the data in question may be restricted in accordance with point 3.4 of this policy.

3.3. Right to object

The data subject may object to the processing of their personal data by means of a statement addressed to the Company if the legal basis of the processing is

• the public interest under Article 6 (1) e) of the GDPR, or
• the legitimate interest under Article 6 (1) f) of the GDPR [the conditions for applying legitimate interest as a legal basis are set out in point 5 of this policy].

Where the right to object is exercised, the Company may no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims. The Company's manager decides whether the processing is justified by compelling legitimate grounds and informs the data subject of the position in an opinion.

3.4. Right to restriction of processing

Processing may be restricted where:

• the data subject contests the accuracy of the data — for a period enabling the Company to verify the accuracy of the personal data;
• the processing is unlawful and the data subject requests the restriction of use instead of erasure;
• the controller no longer needs the data, but the data subject requires it for the establishment, exercise or defence of legal claims;
• the data subject has objected to processing pursuant to Article 21 of the GDPR — pending the verification of whether the objection is justified.

For the duration of assessing the data subject's objection to the processing — but for no more than 5 days — the head of the organisational unit carrying out the processing suspends the processing, examines whether the objection is well founded, makes a decision, and informs the applicant.

If the objection is justified, the head of the organisational unit restricts the data, meaning that only storage as processing may take place, until:

• the data subject consents to the processing;
• the processing of the personal data is necessary for the establishment, exercise or defence of legal claims;
• the processing of the personal data becomes necessary for the protection of the rights of another natural or legal person; or
• the processing is ordered by law in the public interest.

If the restriction of processing was requested by the data subject, the head of the given organisational unit informs the data subject in advance before lifting the restriction.

3.5. Right to erasure (“right to be forgotten”)

The data subject has the right to obtain from the controller the erasure of personal data concerning them without undue delay, and the controller is obliged to erase the personal data without undue delay where one of the following applies:

1. a) the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
2. b) the data subject withdraws the consent on which the processing is based and there is no other legal basis for the processing;
3. c) the data subject objects to the processing pursuant to Article 21 (1) of the GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects pursuant to Article 21 (2);
4. d) the personal data has been unlawfully processed;
5. e) the personal data must be erased to comply with a legal obligation in Union or Member State law to which the controller is subject;

OR

1. f) the personal data was collected in relation to the offer of information society services.

3.6. Right to data portability

The data subject has the right to receive the personal data concerning them, which they have provided to the Company, in a structured, commonly used and machine-readable format, and has the right to transmit that data to another controller without hindrance from the controller to which the personal data was provided, where:

• the legal basis of the processing is the data subject's consent or the processing was necessary for the performance of a contract to which the data subject is a party, or to take steps at the data subject's request prior to entering into a contract [Article 6 (1) a) or b), or Article 9 (2) a) of the GDPR]; and
• the processing is carried out by automated means.

The controller communicates any rectification, erasure or restriction of processing to each recipient to whom the personal data has been disclosed, unless this proves impossible or involves disproportionate effort. The controller informs the data subject about those recipients if the data subject requests it.

The controller compensates damage caused to others by the unlawful processing of the data subject's data or by breaching data-security requirements, and also pays the grievance award due in the event of a personality-rights violation caused by it or by a processor engaged by it. The controller is exempt from liability for the damage caused and from the obligation to pay the grievance award if it proves that it is in no way responsible for the event causing the damage.

The data subject may turn to the NAIH with a complaint about the controller's data-processing procedure:

name: Hungarian National Authority for Data Protection and Freedom of Information (NAIH)

seat: 1055 Budapest, Falk Miksa utca 9-11.

website: www.naih.hu

The data subject may also enforce their claim in court, at their choice. Adjudication of the case falls within the competence of the regional court (törvényszék). The lawsuit may also be brought, at the data subject's choice, before the regional court competent for the data subject's place of residence or stay.

1. Data processing carried out during the use of the controller's website

4.1. Cookies

On the Company's website, software analysing website-visit data runs and records data about visits. The Company receives automatically generated information about visitors to its website: the visitor's internet protocol (IP) address, the time of the visit, data of the pages viewed, and the name of the browser used.

purpose of processing: analysing website-visit habits, facilitating contact with the Company

scope of processed data: the visitor's IP address, the time of the visit, data of the pages viewed, the name of the browser used

legal basis of processing: the data subject's consent under Article 6 (1) a) of the GDPR.

retention period: one year from data entry

manner of storage: electronic

4.2. Registration

On the Company's website the visitor has the option to register. By filling in the form, the visitor provides the relevant data necessary for contact. However, the data subject can only submit the data if they accept the Company's Privacy Policy, which they can do by ticking a checkbox; otherwise the registration cannot be finalised.

By registering, the data subject becomes a regular customer of the Company and thereby becomes entitled to certain benefits.

During registration the data subject may provide delivery and billing details and their phone number, so that after registration they can order products on the platform without providing further data. In the case of an order, the delivery address is passed to the courier as a processor. The exact details of the processor are contained in this policy.

The phone number is needed for the receipt notification. The e-mail address is needed for online contact. Delivery details are needed so that the courier can deliver the ordered product to the address requested by the data subject. Billing details are needed for issuing the invoice.

During registration the data subject may provide their gender, the purpose of which is to enable the Company to conduct market research from the data subject's data: gender, products ordered by them. The market research is anonymous and contains no personal data.

The duration of processing lasts until the registration is deleted, with the caveat that if the data subject makes a purchase after registering, the Company is obliged to keep the accounting documents for at least 8 years pursuant to Section 169 (2) of Act C of 2000 on Accounting. After 8 years the Company automatically deletes the personal data of a data subject who has not ordered a service again within 8 years of the last order.

purpose of processing: facilitating contact with the Company, registration

scope of processed data: the data subject's name, e-mail address, and, where provided, delivery and billing address, phone number

legal basis of processing: the data subject's consent under Article 6 (1) a) of the GDPR

retention period: until the registration is deleted, with the caveat that if the registrant makes a purchase, the Company is obliged to keep the accounting documents for at least 8 years pursuant to Section 169 (2) of Act C of 2000 on Accounting.

manner of storage: electronic

In the case of card payment, the bank card and card-payment transaction data are handled by Barion Payment Zrt.; the card data does not reach the Company.

scope of transmitted data: for card payments, the payer's identifier, the amount, date and time of the transaction, to Barion Payment Zrt.

legal basis of the transfer: the data subject's consent under Article 6 (1) a) of the GDPR.

4.3. Processing of customer data

Visitors to the website can order and purchase the Company's products with or without registration. Before ordering the selected product — i.e. before the contract between the customer and the Company is concluded — the customer provides the relevant data necessary for the delivery and billing of the ordered product.

The delivery address is passed to the courier as a processor. The exact details of the processor are contained in this policy.

The phone number is needed for the receipt notification. The e-mail address is needed for online contact. Delivery details are needed so that the courier can deliver the ordered product to the address requested by the data subject. Billing details are needed for issuing the invoice.

purpose of processing: purchasing and ordering via the Company's website, issuing invoices, fulfilling accounting obligations, keeping records of customers, fulfilling orders, analysing customer habits

scope of processed data: the data subject's name, e-mail address, phone number, delivery and billing details

legal basis of processing: the data subject's consent under Article 6 (1) a) of the GDPR, and Section 169 (2) of Act C of 2000 on Accounting

retention period: until erasure at the data subject's request; for data appearing on the invoice, eight years in accordance with Section 169 (2) of the Accounting Act

manner of storage: electronic

In the case of card payment, the bank card and card-payment transaction data are handled by Barion Payment Zrt.; the card data does not reach the Company.

scope of transmitted data: for card payments, the payer's identifier, the amount, date and time of the transaction, to Barion Payment Zrt.

legal basis of the transfer: the data subject's consent under Article 6 (1) a) of the GDPR

4.4. Processing related to complaints

Pursuant to Act CLV of 1997 on Consumer Protection (Fgy.tv.), the customer is entitled to submit a complaint to the Company orally, by electronic means or in writing. Electronic complaints can be sent by the customer to the e-mail address info@zoldsegesem.hu.

purpose of processing: investigating and handling customer complaints

scope of processed data: the data subject's name, address, e-mail address, and other data related to the complaint specified in Section 17/A (5) of the Fgy.tv.

legal basis of processing: the data subject's consent under Article 6 (1) a) of the GDPR, and Section 17/A (5) of the Fgy.tv.

retention period: until the purpose is achieved: if, after the reply is sent, the data subject does not raise a further objection, the controller deletes the data 5 years after sending the reply; in the event of further claim enforcement, the data is deleted after the limitation period expires

manner of storage: electronic

4.5. Processing related to newsletters and direct marketing

In order to serve customers' needs as fully as possible, the Company sends e-mails and newsletters to the data subject for direct-offer or informational purposes, based on the data subject's prior, clear and express consent. If the data subject subscribes to the newsletter on the website, they must accept the Privacy Policy at the place of subscription, which they can do by ticking a checkbox. The Company ensures that the data subject can unsubscribe from marketing e-mails free of charge at any time. The Company also conveys such information to customers in person or by phone.

If the data subject subscribes to the newsletter, the Company may send targeted offers to the data subject as part of its direct-marketing activity. If the data subject does not wish to consent to profiling, they may object to the processing at the e-mail address provided by the Company.

We inform data subjects that, for sending newsletters and e-mails, the Company has contracted with the processors Mailchimp (The Rocket Science Group LLC, United States) and Brevo (Sendinblue SAS, France). Both providers have undertaken to comply with the GDPR.

If the data subject requests the erasure of their data, the Company keeps a prohibition list in accordance with Act CXIX of 1995 on the processing of name and address data for research and direct marketing purposes (Katv.). The Company undertakes to check, before any promotional contact, whether the data subject is on the prohibition list.

purpose of processing: informing data subjects about the Company's most important news, direct marketing

scope of processed data: the data subject's name, e-mail address

legal basis of processing: the data subject's consent under Article 6 (1) a) of the GDPR

retention period: until the end of operation of the newsletter service, but if the data subject requests the erasure of their data (unsubscribes from the newsletter), immediately after the erasure request

manner of storage: electronic

1. Data processors

During the processing of personal data, the Company uses the following processors solely to perform tasks of a technical nature:

processor name: Varga Katalin

address: 8700 Marcali, József A. utca 31.

tax number: 68676867-1-34

purpose of processing: accounting

Processor name: Mailchimp, The Rocket Science Group LLC d/b/a

address: 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, Georgia, 30308

purpose of processing: sending newsletters

Processor name: Brevo (Sendinblue SAS)

address: 106 boulevard Haussmann, 75008 Paris, France

purpose of processing: sending transactional e-mails and newsletters

Processor name: Cloudflare, Inc.

address: 101 Townsend Street, San Francisco, CA 94107, United States

purpose of processing: hosting and server services (CDN, data storage)

The processors act as follows in the course of their activities:

• they carry out the processing in accordance with the Company's instructions;
• they may not make substantive decisions affecting the processing;
• they may process the personal data they learn solely in accordance with the Company's instructions;
• they may not carry out processing for their own purposes;
• they are obliged to store and retain the personal data in accordance with the Company's instructions.

1. Amendment of the statement

The data controller reserves the right to amend this statement. If the amendment affects the use of personal data provided by the data subject, the controller informs the user of the changes by an e-mail notification. If, due to the amendment, the details of the processing also change, the controller requests the data subject's consent separately.

1. Matters not regulated in this policy

In matters not regulated in this policy, the provisions of the GDPR and, where permitted by it, as a supplement, the provisions of the Hungarian Information Act (Infotv.) govern.